Loading story…
A high-severity flaw tracked as CVE-2026-15416 allows unauthenticated remote code execution in Argo CD by abusing the repo-server's GenerateManifest gRPC endpoint. According to Red Hat and related disclosures, an attacker with network access to the repo-server interface can exploit malicious KustomizeOptions, including BuildOptions or BinaryPath, to run arbitrary commands inside the repo-server pod. The issue is rated CVSS 8.9 and mapped to CWE-306 for missing authentication on a critical function.
The vulnerability can also be chained with access to the Argo CD Redis cache to tamper with cached data and push attacker-controlled Kubernetes manifests to Argo CD-managed environments, creating a path to full cluster compromise. Red Hat said affected products include Argo CD deployments and related OpenShift components, while OpenShift GitOps 1.20 and 1.21 are not affected because default Kubernetes NetworkPolicy settings block the required access to internal repo-server and Redis services. Recommended actions include patching to a fixed version, preventing external exposure of the repo-server, restricting network access to the gRPC endpoint and Redis, and reviewing deployment configurations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-15416 was published as a high-severity Argo CD vulnerability with CVSS 8.9 and CWE-306 classification. The publication described unauthenticated remote code execution through the repo-server's GenerateManifest gRPC endpoint and identified affected Red Hat products and patching guidance.
A Red Hat Bugzilla entry documented technical details of the vulnerability, explaining that malicious KustomizeOptions such as BuildOptions or BinaryPath could be abused to execute arbitrary commands in the repo-server pod. It also described how combining the flaw with Redis cache manipulation could enable deployment of attacker-controlled Kubernetes manifests.
Red Hat published an advisory for CVE-2026-15416 describing an unauthenticated remote code execution flaw in Argo CD's repo-server via the GenerateManifest gRPC endpoint. The advisory also noted potential cluster compromise through Redis cache manipulation and listed mitigations such as restricting network access and updating to a fixed version when available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed an **unpatched unauthenticated remote code execution flaw** in Argo CD’s `repo-server` that can be exploited through the gRPC `GenerateManifest` endpoint when attackers can reach the internal service port. The attack chain abuses Argo CD’s handling of Kustomize options, allowing a crafted request to pass attacker-controlled settings such as `--enable-helm` and `--helm-command` so code from a malicious Git repository is executed on the repo-server host. Synacktiv said it reported the issue to Argo CD maintainers in January 2025, but no patch or CVE had been issued at the time of disclosure. After achieving code execution, the researchers demonstrated theft of the `REDIS_PASSWORD` environment variable and poisoning of Argo CD’s Redis-backed cache to force deployment of attacker-controlled manifests on the next sync, creating a path to **full Kubernetes cluster compromise**. The reported mitigation is to enforce Kubernetes network policies that restrict access to `repo-server` and Redis to trusted Argo CD components, as those protections are not enabled by default in common Helm-based deployments.
Jul 12, 2026
A critical flaw in Argo CD, tracked as **`CVE-2026-43824`**, exposed plaintext Kubernetes Secrets to low-privileged authenticated users through the `ServerSideDiff` endpoint. The vulnerability was caused by missing authorization and secret-masking protections, allowing the endpoint to return raw `PredictedLive` and `NormalizedLive` data from the Kubernetes API without applying Argo CD’s normal `hideSecretData()` masking. As a result, users with application `get` access could retrieve sensitive values including service account tokens, TLS material, database credentials, and API keys. The risk was heightened when an Application used the annotation `argocd.argoproj.io/compare-options: IncludeMutationWebhook=true`, which bypassed an additional sanitization step and made secret extraction especially effective for resources influenced by mutation webhooks. The issue affected Argo CD versions **3.2.0 through 3.3.8**, and maintainers released fixes in **3.2.11** and **3.3.9**. Administrators were urged to upgrade, tighten RBAC permissions, remove the risky annotation where possible, and review Argo CD API logs for suspicious `ServerSideDiff` activity.
Jun 29, 2026
A critical vulnerability (CVE-2025-13888) has been identified in OpenShift GitOps, allowing namespace administrators to escalate privileges and potentially take over entire Kubernetes clusters. The flaw enables authenticated attackers to create ArgoCD Custom Resources (CRs) that manipulate the system into granting elevated permissions in other namespaces, including those with privileged access. By leveraging these permissions, attackers can deploy privileged workloads on master nodes, effectively achieving root access across the cluster. Security advisories highlight that this vulnerability is remotely exploitable and poses a significant risk to organizations using OpenShift GitOps. The issue was disclosed by Red Hat, and while specific affected product versions are not detailed, the vulnerability is rated as critical with a CVSS score of 9.1. Organizations are urged to review their OpenShift GitOps deployments and apply mitigations or patches as recommended by the vendor to prevent potential exploitation and cluster compromise.
Jun 29, 2026